Skip to content

Releases: npm/cli

v6.8.0-next.0

31 Jan 20:52
@aeschright aeschright
v6.8.0-next.0
309260d
Compare
Choose a tag to compare
v6.8.0-next.0 Pre-release
Pre-release

This release includes an implementation of RFC #10, documenting an optional field that can be used to specify the directory path for a package within a monorepo.

NEW FEATURES

BUGFIXES

DEPENDENCY BUMPS

MISC

Assets 2
Loading

v6.7.0

23 Jan 22:22
@zkat zkat
v6.7.0
This tag was signed with the committer’s verified signature.
zkat Kat Marchán
GPG key ID: AEB529C08A3C7E9E
Verified
Learn about vigilant mode.
f6e31a7
Compare
Choose a tag to compare
v6.7.0

Hey y'all! This is a quick hotfix release that includes some important fixes to [email protected] related to the large rewrite/refactor. We're tagging it as a feature release because the changes involve some minor new features, and semver is semver, but there's nothing major here.

NEW FEATURES

  • 50463f58b Improve usage errors to npm org commands and add optional filtering to npm org ls subcommand. (@zkat)

BUGFIXES

  • 4027070b0 Fix default usage printout for npm org so you actually see how it's supposed to be used. (@zkat)
  • cfea6ea5b fix default usage message for npm hook (@zkat)

DOCS

DEPENDENCY BUMPS

Assets 2
Loading

v6.6.0

17 Jan 23:02
@aeschright aeschright
v6.6.0
bb8688d
Compare
Choose a tag to compare
v6.6.0

REFACTORING OUT npm-REGISTRY-CLIENT

Today is an auspicious day! This release marks the end of a massive internal refactor to npm that means we finally got rid of the legacy npm-registry-client in favor of the shiny, new, window.fetch-like npm-registry-fetch.

Now, the installer had already done most of this work with the release of npm@5, but it turns out every other command still used the legacy client. This release updates all of those commands to use the new client, and while we're at it, adds a few extra goodies:

  • All OTP-requiring commands will now prompt. --otp is no longer required for dist-tag, access, et al.
  • We're starting to integrate a new config system which will eventually get extracted into a standalone package.
  • We now use libnpm for the API functionality of a lot of our commands! That means you can install a library if you want to write your own tooling around them.
  • There's now an npm org command for managing users in your org.
  • pacote now consumes npm-style configurations, instead of its own naming for various config vars. This will make it easier to load npm configs using libnpm.config and hand them directly to pacote.

There's too many commits to list all of them here, so check out the PR if you're curious about details:

NEW FEATURES

BUGFIXES

DOCS

DEPENDENCIES

Read more
Assets 2
Loading

v6.6.0-next.1

10 Jan 22:39
@aeschright aeschright
v6.6.0-next.1
6c89adb
Compare
Choose a tag to compare
v6.6.0-next.1 Pre-release
Pre-release

REFACTORING OUT npm-REGISTRY-CLIENT

Today is an auspicious day! This release marks the end of a massive internal refactor to npm that means we finally got rid of the legacy npm-registry-client in favor of the shiny, new, window.fetch-like npm-registry-fetch.

Now, the installer had already done most of this work with the release of npm@5, but it turns out every other command still used the legacy client. This release updates all of those commands to use the new client, and while we're at it, adds a few extra goodies:

  • All OTP-requiring commands will now prompt. --otp is no longer required for dist-tag, access, et al.
  • We're starting to integrate a new config system which will eventually get extracted into a standalone package.
  • We now use libnpm for the API functionality of a lot of our commands! That means you can install a library if you want to write your own tooling around them.
  • There's now an npm org command for managing users in your org.
  • pacote now consumes npm-style configurations, instead of its own naming for various config vars. This will make it easier to load npm configs using libnpm.config and hand them directly to pacote.

There's too many commits to list all of them here, so check out the PR if you're curious about details:

NEW FEATURES

BUGFIXES

DOCS

DEPENDENCIES

Read more
Assets 2
Loading

v6.6.0-next.0

12 Dec 22:09
@fharper fharper
v6.6.0-next.0
56440dd
Compare
Choose a tag to compare
v6.6.0-next.0 Pre-release
Pre-release

REFACTORING OUT npm-REGISTRY-CLIENT

Today is an auspicious day! This release marks the end of a massive internal refactor to npm that means we finally got rid of the legacy npm-registry-client in favor of the shiny, new, window.fetch-like npm-registry-fetch.

Now, the installer had already done most of this work with the release of npm@5, but it turns out every other command still used the legacy client. This release updates all of those commands to use the new client, and while we're at it, adds a few extra goodies:

  • All OTP-requiring commands will now prompt. --otp is no longer required for dist-tag, access, et al.
  • We're starting to integrate a new config system which will eventually get extracted into a standalone package.
  • We now use libnpm for the API functionality of a lot of our commands! That means you can install a library if you want to write your own tooling around them.
  • There's now an npm org command for managing users in your org.
  • pacote now consumes npm-style configurations, instead of its own naming for various config vars. This will make it easier to load npm configs using libnpm.config and hand them directly to pacote.

There's too many commits to list all of them here, so check out the PR if you're curious about details:

NEW FEATURES

BUGFIXES

DOCS

DEPENDENCIES

Assets 2
Loading

v6.5.0

12 Dec 22:02
@aeschright aeschright
v6.5.0
ab0f026
Compare
Choose a tag to compare
v6.5.0

NEW FEATURES

BUGFIXES

DOCS UPDATES

DEPENDENCIES

MISCELLANEOUS

Assets 2
Loading

v6.5.0-next.0

28 Nov 22:44
@aeschright aeschright
v6.5.0-next.0
d6ba95a
Compare
Choose a tag to compare
v6.5.0-next.0 Pre-release
Pre-release

This release became [email protected].

Assets 2
Loading

v6.4.1

29 Aug 18:24
@zkat zkat
v6.4.1
This tag was signed with the committer’s verified signature.
zkat Kat Marchán
GPG key ID: AEB529C08A3C7E9E
Verified
Learn about vigilant mode.
59e5056
Compare
Choose a tag to compare
v6.4.1

BUGFIXES

  • 4bd40f543 #42 Prevent blowing up on malformed responses from the npm audit endpoint, such as with third-party registries. (@framp)
  • 0e576f0aa #46 Fix NO_PROXY support by renaming npm-side config to --noproxy. The environment variable should still work. (@SneakyFish5)
  • d8e811d6a #33 Disable update-notifier checks when a CI environment is detected. (@Sibiraj-S)
  • 1bc5b8cea #47 Fix issue where postpack scripts would break if pack was used with --dry-run. (@larsgw)

DEPENDENCY BUMPS

DOCUMENTATION

Assets 2
Loading

v6.4.1-next.0

23 Aug 01:34
@zkat zkat
v6.4.1-next.0
This tag was signed with the committer’s verified signature.
zkat Kat Marchán
GPG key ID: AEB529C08A3C7E9E
Verified
Learn about vigilant mode.
bae4ede
Compare
Choose a tag to compare
v6.4.1-next.0 Pre-release
Pre-release

This release became [email protected].

Assets 2
Loading

v6.4.0

15 Aug 18:19
@zkat zkat
v6.4.0
This tag was signed with the committer’s verified signature.
zkat Kat Marchán
GPG key ID: AEB529C08A3C7E9E
Verified
Learn about vigilant mode.
58ece89
Compare
Choose a tag to compare
v6.4.0

NEW FEATURES

  • 6e9f04b0b npm/cli#8 Search for authentication token defined by environment variables by preventing the translation layer from env variable to npm option from breaking :_authToken. (@mkhl)
  • 84bfd23e7 npm/cli#35 Stop filtering out non-IPv4 addresses from local-addrs, making npm actually use IPv6 addresses when it must. (@valentin2105)
  • 792c8c709 npm/cli#31 configurable audit level for non-zero exit npm audit currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of --audit-level to npm audit to allow it to pass if only vulnerabilities below a certain level are found. Example: npm audit --audit-level=high will exit with 0 if only low or moderate level vulns are detected. (@lennym)

BUGFIXES

DEPENDENCY UPDATES

A very special dependency update event! Since the release of [email protected], an awkward version conflict that was preventing request from begin flattened was resolved. This means two things:

  1. We've cut down the npm tarball size by another 200kb, to 4.6MB
  2. npm audit now shows no vulnerabilities for npm itself!

Thanks, @rvagg!

DOCUMENTATION

Assets 2
Loading